A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`

pyasn1 has a DoS vulnerability in decoder

urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)

Libsoup: heap use-after-free in libsoup message queue handling during http/2 read completion

Libtiff: tiffrasterscanlinesize64 produce too-big size and could cause oom

PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed

net-imap vulnerable to STARTTLS stripping via invalid response timing

Gnutls: gnutls: security bypass due to incorrect name constraint handling

Gnutls: gnutls: policy bypass due to case-sensitive nameconstraints comparison

Out of bounds read in IMAP parsing

Libkcapi: memory corruption via uncanceled aio requests on error in libkcapi's one-shot aio path

Pcp: pcp pmproxy: unauthenticated access to /store endpoint allows bypassing pmcd access rules

Libtiff: libtiff: heap-based buffer overflow via crafted pixarlog-compressed tiff image

Ansible-collection-ansible-posix: ansible.posix authorized_key: local privilege escalation via symlink-following chown

Apache HTTP Server: Stack Buffer Over-Read in mod_ssl OCSP `send_request`

IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob

Use-after-free in the DOM: Bindings (WebIDL) component

Use-after-free in the DOM: Networking component

Memory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1

Memory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1

Incorrect boundary conditions in the WebRTC component

Incorrect boundary conditions in the WebRTC component

Uninitialized memory in the Audio/Video: Web Codecs component

Vim affected by Command injection via newline in glob()

Pki-core: dogtag/pki: certprofile-import allows code execution via unsanitized profile content (externalprocessconstraint)

MariaDB: wsrep SST unsafe parameter handling on the donor side (rsync)

389-ds-base: 389-ds-base: remote code execution and denial of service via heap buffer overflow

Mrtg: mrtg daemon symlink-following chown allows local privilege escalation via pid file path manipulation

Gstreamer: gstreamer1-plugins-ugly-free: gstreamer: integer overflow/underflow in asfdemux bounds checks leading to out-of-bounds read

Xdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c

Gstreamer1-plugins-bad-free: gstreamer: rfbsrc/librfb hextile heap out-of-bounds write with 16bpp framebuffer

acl < 2.4.0 Symlink Traversal Privilege Escalation via libacl Functions

Gstreamer1-plugins-bad-free: gstreamer: signed integer overflow in vmnc decoder cursor payload handling

Gstreamer1-plugins-ugly-free: gstreamer: out-of-bounds read in realmedia demuxer fileinfo metadata parser

Gstreamer1-plugins-ugly-free: gstreamer: out-of-bounds read in realmedia demuxer audio stream header parser

Gstreamer1-plugins-bad-free: gstreamer: out-of-bounds read via jpeg segment length validation in va decoder

smb: client: reject userspace cifs.spnego descriptions

selinux: fix overlayfs mmap() and mprotect() access checks

Gnutls: gnutls: certificate validation bypass due to improper handling of uri and srv sans

ptrace: slightly saner 'get_dumpable()' logic

Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()

Udisks: missing authorization check allows unprivileged users to restore luks headers via udisks d-bus api

Valkey Affected by RESP Protocol Injection via Lua error_reply

A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the `vm` module with the timeout option

Gvfs: gvfs-admin socket ownership race permits local root

Libcap: libcap: privilege escalation via toctou race condition in cap_set_file()

Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns

Librest: weak random number generation in pkce implementation

USB: serial: io_ti: fix heap overflow in get_manuf_info()

Samba: group policy certificate enrollment uses http:// without validation